AzuraCast up to 0.23.7 Webhook URL Validation AbstractConnector.php getValidUrl server-side request forgery

Summaryinfo

A vulnerability was found in AzuraCast up to 0.23.7. It has been rated as critical. This affects the function AbstractConnector::getValidUrl of the file backend/src/Webhook/Connector/AbstractConnector.php of the component Webhook URL Validation. Performing a manipulation results in server-side request forgery. This vulnerability is identified as CVE-2026-100849. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in AzuraCast up to 0.23.7. This affects the function AbstractConnector::getValidUrl of the file backend/src/Webhook/Connector/AbstractConnector.php of the component Webhook URL Validation. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Connector/AbstractConnector.php), used by the Generic and Discord webhook connectors, rejects only URLs whose host is a literal link-local IP address (169.254.0.0/16 or fe80::/10). Loopback addresses and RFC1918 private ranges are not rejected, and any non-literal-IP hostname causes the IP parsing call to throw, which skips the check entirely. A user holding only the station-scoped WebHooks permission can therefore configure a webhook pointing at an internal, loopback, or private-network target and cause the server to issue an outbound HTTP POST containing the station's Now Playing data, resulting in server-side request forgery. The PUT /station/{id}/webhook/{id}/test endpoint allows the same low-privileged user to trigger the request on demand. At the time of the advisory no patched version was available.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-100849 since 09/27/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

By approaching the search of inurl:backend/src/Webhook/Connector/AbstractConnector.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.23.8 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• AzuraCast

Version

• 0.23.0
• 0.23.1
• 0.23.2
• 0.23.3
• 0.23.4
• 0.23.5
• 0.23.6
• 0.23.7

Website

• Product: https://github.com/AzuraCast/AzuraCast/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion